CVE-2025-27514 — Cross-site Scripting in Glpi

CWE-79 — Cross-site ScriptingCWE-80 — Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)3 documents3 sources
Severity
5.4MEDIUMNVD
EPSS
0.0%
top 87.23%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Glpi-project Glpi
Timeline
PublishedJul 29

Description

GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. In versions 9.5.0 through 10.0.18, a technician can use a malicious payload to trigger a stored XSS on the project's kanban. This is fixed in version 10.0.19.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitability: 2.3 | Impact: 2.7

Affected Packages2 packages

▶NVDglpi-project/glpi9.5.0 — 10.0.19
▶CVEListV5glpi-project/glpi>= 9.5.0, < 10.0.19

Patches

Patch: github.com ↗

🔴Vulnerability Details

1
OSV
CVE-2025-27514: GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing↗2025-07-29
▶